CTI · corroborated · 2026-09-12

ConfigServer Firewall Remote Code Execution CVE-2026-65638

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1059 Command and Scripting Interpreter Execution

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: ConfigServer Firewall CVE-2026-65638 MESSENGER Service Exploitation
id: c9d0e1f2-a3b4-5678-cdef-789012345678
status: experimental
description: Detects exploitation of CVE-2026-65638 in ConfigServer Firewall MESSENGER service for unauthenticated command execution
references:
  - https://www.gbhackers.com/
author: Tia N. List
date: 2026-09-12
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  product: linux
  category: process_creation
detection:
  selection_csf_process:
    Image|endswith:
      - '/csf'
      - '/csf狗狗'
    CommandLine|contains:
      - 'MESSENGER'
      - 'messenger'
  selection_suspicious_shell:
    Image|endswith:
      - '/sh'
      - '/bash'
    CommandLine|contains:
      - 'csf'
      - 'configserver'
      - 'firewall'
  condition: selection_csf_process or selection_suspicious_shell
falsepositives:
  - Legitimate CSF administration
level: critical

References

• https://www.gbhackers.com/